1. Data Controller

The data controller responsible for the processing of your personal data is:

As the data controller, we determine the purposes and means of processing your personal data. We are accountable for ensuring that all processing activities comply with applicable data protection legislation, including the GDPR where it applies to individuals located in the European Economic Area (EEA) or the United Kingdom.

2. Data Protection Officer (DPO)

We have appointed a Data Protection Officer to oversee our data protection strategy and ensure compliance with data protection laws. You may contact our DPO directly for any questions, concerns, or requests relating to your personal data:

3. Scope and Applicability

This Privacy Policy applies to all personal data collected by ValvellianprestigeHaven through the following channels and activities:

• Visiting and browsing our Website at valvellianprestigehaven.com
• Making a room reservation or booking via our Website, telephone, email, or third-party booking platforms
• Checking in and staying at our hotel in Canberra, Australia
• Using our casino facilities, gaming floors, and entertainment services
• Participating in our loyalty or rewards programme
• Receiving or requesting marketing communications and newsletters
• Contacting our customer service or submitting enquiries, feedback, or complaints
• Using our food and beverage outlets, spa, wellness, and other ancillary services
• Attending events, conferences, or functions hosted at our property
• Participating in promotions, competitions, or surveys
• Accessing our Wi-Fi network as a guest

This Policy applies regardless of the country in which you are located, and we take particular care to meet the standards of the GDPR for all individuals who are residents of the EEA or the United Kingdom.

4. Personal Data We Collect

We collect and process various categories of personal data depending on how you interact with us. Below is a detailed overview of the types of personal data we may collect:

4.1 Identity and Contact Data

• Full name (first name, middle name, last name)
• Date of birth and age verification information
• Gender
• Nationality and country of residence
• Passport number, national identity card number, or other government-issued identification
• Postal address (residential and billing)
• Email address
• Telephone number (mobile and/or landline)
• Signature (physical or electronic)

4.2 Reservation and Stay Data

• Booking reference numbers and confirmation details
• Check-in and check-out dates and times
• Room type, preferences, and special requests
• Number of guests and accompanying persons
• Loyalty programme membership number and history
• Guest history and previous stays at our property
• Dietary requirements and accessibility needs
• Preferences for room temperature, bedding, pillow type, and other amenities

4.3 Financial and Payment Data

• Credit card, debit card, and bank account details (processed securely via PCI-DSS compliant payment processors)
• Billing address
• Transaction history and invoices
• Deposit and payment records
• Casino credit account information and gaming transactions
• Foreign exchange transaction records

4.4 Casino and Gaming Data

As a licensed casino operator, we are legally required to collect and process additional personal data in connection with gaming activities. This includes:

• Age verification documents confirming you are of legal gambling age
• Player account registration information
• Gaming activity records, including game type, duration, and betting history
• Win/loss records and cashout information
• Self-exclusion records and responsible gambling declarations
• Anti-money laundering (AML) and know-your-customer (KYC) documentation
• Source of funds declarations where required by law
• Casino chip and token transactions
• Complimentary services extended in connection with gaming activities

4.5 Technical and Usage Data

• IP address and approximate geographic location derived from IP
• Browser type and version
• Device type, operating system, and device identifiers
• Pages visited, time spent on pages, and navigation paths on our Website
• Referring URLs and exit pages
• Date and time of Website visits
• Cookie identifiers and similar tracking technology data (see our Cookie Policy)
• Wi-Fi access logs when using our guest network

4.6 Communications Data

• Content of emails, chat messages, and other correspondence you send us
• Telephone call recordings (where you have been notified and calls are recorded for quality and training purposes)
• Feedback, complaints, and survey responses
• Social media interactions and messages directed to our official accounts

4.7 Marketing and Preferences Data

• Marketing communication preferences and consent records
• Newsletter subscription status
• Preferences for types of promotions and offers
• Participation records for competitions and prize draws

4.8 Special Categories of Personal Data

In limited and specific circumstances, we may process special categories of personal data as defined under Article 9 of the GDPR. These circumstances include:

• Health and disability information: Where you inform us of a disability, health condition, or accessibility requirement so that we may make appropriate arrangements for your comfort and safety during your stay.
• Dietary requirements: Where dietary preferences or restrictions reveal information about religious beliefs or health conditions (e.g., halal, kosher, gluten-free requirements).
• Biometric data: Only where expressly required by applicable law or regulation and with your explicit consent, such as in connection with legally mandated identity verification processes.

We will only process special categories of personal data on the basis of your explicit consent (Article 9(2)(a) GDPR), where processing is necessary to protect your vital interests (Article 9(2)(c) GDPR), where required by law for substantial public interest reasons (Article 9(2)(g) GDPR), or where necessary for the establishment, exercise, or defence of legal claims (Article 9(2)(f) GDPR).

4.9 Data Collected from Third Parties

We may also receive personal data about you from third parties, including:

• Online travel agencies (OTAs) such as Booking.com, Expedia, and similar platforms through which you make a reservation
• Corporate travel management companies acting on behalf of business travellers
• Event organisers or conference planners booking on your behalf
• Regulatory and law enforcement authorities providing information relevant to our legal obligations
• Credit reference and fraud prevention agencies
• Social media platforms where you engage with our public pages or use social login features

5. Legal Basis for Processing Personal Data

We process your personal data only where we have a valid legal basis to do so, as required by Article 6 of the GDPR. The legal bases we rely upon are described below, together with examples of the processing activities to which they apply.

5.1 Performance of a Contract (Article 6(1)(b) GDPR)

Processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract. We rely on this legal basis to:

• Process your hotel reservation, check-in, and check-out
• Manage your account and loyalty programme membership
• Process payments for accommodation, dining, casino services, and other offerings
• Provide the specific services and amenities you have requested
• Handle cancellations, refunds, and modifications to your booking
• Fulfil obligations under a casino player account agreement

5.2 Compliance with a Legal Obligation (Article 6(1)(c) GDPR)

Processing is necessary for compliance with a legal obligation to which we are subject. We rely on this legal basis to:

• Conduct identity verification and age checks as required under casino licensing regulations
• Comply with anti-money laundering (AML) and counter-terrorism financing (CTF) obligations
• Maintain statutory financial and accounting records
• Respond to lawful requests from regulatory bodies, law enforcement agencies, and courts
• Fulfil mandatory guest registration requirements under applicable hotel and tourism legislation
• Comply with responsible gambling obligations, including processing self-exclusion registrations
• Comply with tax reporting and withholding requirements on gaming winnings

5.3 Legitimate Interests (Article 6(1)(f) GDPR)

Processing is necessary for the purposes of the legitimate interests pursued by us or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms. We rely on this legal basis to:

• Ensure the security of our property, guests, staff, and assets through CCTV surveillance and security monitoring
• Prevent, detect, and investigate fraud, theft, cheating, and other misconduct on our premises
• Improve the quality of our services, Website, and guest experience through analytics
• Personalise your experience based on your recorded preferences and stay history
• Manage and resolve complaints and disputes effectively
• Send you relevant service-related communications and updates to existing bookings
• Exercise or defend legal claims and manage legal risks
• Conduct internal audits, risk management, and business analysis
• Ensure network and information security for our Website and IT systems

When we rely on legitimate interests, we have carefully balanced our interests against your rights and freedoms. You may request further information about this balancing assessment by contacting us at privacy@valvellianprestigehaven.com.

5.4 Consent (Article 6(1)(a) GDPR)

Where we rely on your consent as the legal basis for processing, we will ask for your explicit, informed, and freely given consent before commencing that processing activity. We rely on consent to:

• Send you marketing emails, newsletters, promotional offers, and event invitations
• Place non-essential cookies and similar tracking technologies on your device
• Process special categories of personal data not otherwise covered by another legal basis
• Share your data with select third-party partners for their own marketing purposes (where you have opted in)

You have the right to withdraw your consent at any time without detriment. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal. To withdraw consent, please contact us at privacy@valvellianprestigehaven.com or use the unsubscribe mechanism included in any marketing communication we send you.

5.5 Protection of Vital Interests (Article 6(1)(d) GDPR)

In exceptional circumstances, we may process personal data where it is necessary to protect the vital interests of you or another natural person. This may arise, for example, in medical emergencies occurring on our premises where we need to share information with emergency services.

5.6 Public Interest or Official Authority (Article 6(1)(e) GDPR)

In limited circumstances, processing may be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. We may rely on this basis where required by applicable casino regulatory frameworks or public health obligations.

6. How We Use Your Personal Data

We use the personal data we collect for the following specific purposes, each underpinned by an appropriate legal basis as described in Section 5:

6.1 Hotel Operations and Guest Services

• Processing and confirming your accommodation reservation
• Managing your arrival, check-in, and check-out experience
• Allocating your room and arranging requested amenities and services
• Responding to guest requests, enquiries, and service complaints during your stay
• Processing in-house charges, room service orders, and minibar consumption
• Coordinating concierge services, transport arrangements, and activity bookings
• Providing personalised services based on preferences recorded from previous stays

6.2 Casino Operations

• Verifying your identity and confirming you meet the minimum legal age for gambling
• Managing your casino player account and gaming history
• Processing gaming transactions, winnings, and losses
• Administering complimentary services and promotional gaming offers
• Implementing and monitoring responsible gambling measures and self-exclusion programmes
• Detecting and preventing cheating, fraud, advantage play, and money laundering in gaming activities
• Complying with all obligations imposed by our gaming licence and applicable casino legislation

6.3 Financial Transactions and Billing

• Processing payments for all hotel and casino services securely
• Issuing invoices, receipts, and billing statements
• Managing refunds, disputed charges, and payment queries
• Preventing and detecting payment fraud and unauthorised transactions
• Complying with financial record-keeping and tax obligations

6.4 Marketing and Communications

• Sending you personalised offers, promotions, and special packages (where you have consented or we have a legitimate interest)
• Notifying you about upcoming events, entertainment programmes, and seasonal promotions
• Distributing our newsletter and lifestyle content
• Inviting you to participate in satisfaction surveys and feedback programmes
• Managing your communication preferences and marketing opt-ins/opt-outs

6.5 Loyalty Programme Management

• Enrolling you in and managing your membership of our loyalty or rewards programme
• Tracking points, rewards, and redemption history
• Communicating tier status updates and exclusive member benefits

6.6 Security, Safety, and Fraud Prevention

• Operating CCTV cameras across our hotel and casino premises for security and safety purposes
• Monitoring access to restricted areas of the casino and hotel
• Investigating incidents of theft, fraud, violence, or other misconduct
• Sharing information with law enforcement authorities where required or appropriate
• Maintaining exclusion registers and lists of barred individuals

6.7 Website and Digital Services

• Operating, maintaining, and improving our Website
• Analysing Website traffic, visitor behaviour, and engagement metrics
• Ensuring the security and integrity of our IT systems and networks
• Personalising your online experience through cookies and similar technologies
• Processing online booking enquiries and contact form submissions

6.8 Legal Compliance and Regulatory Affairs

• Meeting all obligations imposed by Australian law, gaming regulations, and financial legislation
• Responding to requests from regulators, government agencies, and courts
• Establishing, exercising, and defending legal claims
• Conducting internal audits and compliance reviews

7. Sharing of Personal Data

We do not sell your personal data to third parties. We may share your personal data with the following categories of recipients, and only where necessary and proportionate to the purpose:

7.1 Service Providers and Data Processors

We engage trusted third-party service providers who process personal data on our behalf and under our instructions. These processors are contractually bound to protect your data and may not use it for their own purposes. They include:

• Payment processors: Entities that securely process credit card and payment transactions on our behalf
• IT and cloud services providers: Companies hosting our Website, databases, reservation systems, and email platforms
• Property management system (PMS) providers: Software vendors supporting hotel operations and reservation management
• Casino management system providers: Technology providers supporting gaming operations
• Customer relationship management (CRM) vendors: Platforms used to manage guest profiles and communications
• Marketing and email service providers: Platforms used to send newsletters and promotional communications
• Analytics providers: Services such as website analytics tools that help us understand usage patterns
• Security service providers: Companies providing CCTV monitoring, physical security, and cybersecurity services
• Legal, accounting, and auditing firms: Professional advisers who assist us in meeting our legal and financial obligations
• Laundry, catering, and facility management contractors: Where incidental personal data may be shared in the course of service delivery

7.2 Business Partners and Online Travel Agencies

Where you have made a reservation through an online travel agency (OTA) or travel management company, we will receive your booking data from them and may share updates regarding your reservation with them. These entities operate as independent data controllers and are governed by their own privacy policies.

7.3 Regulatory Authorities and Law Enforcement

We may disclose your personal data to regulatory authorities, law enforcement agencies, courts, tribunals, or government bodies where we are legally required to do so, or where disclosure is necessary to:

• Comply with anti-money laundering (AML) and counter-terrorism financing (CTF) reporting obligations
• Respond to lawful warrants, court orders, or regulatory enquiries
• Assist in the prevention and detection of crime
• Comply with responsible gambling reporting obligations imposed by our gaming licence
• Fulfil mandatory guest registration requirements under hotel and tourism legislation

7.4 Group Companies and Affiliates

Where operates as part of a group of companies, we may share personal data with affiliated entities within the group for internal administrative purposes, group-wide IT support, and consolidated financial reporting. All such sharing is subject to appropriate data protection agreements.

7.5 Business Transfers

In the event of a merger, acquisition, restructuring, sale of assets, or insolvency proceeding, your personal data may be transferred to a successor entity as part of the transaction. We will notify you via email or a prominent notice on our Website if such a change occurs and will inform you of your rights in relation to the transferred data.

7.6 Third Parties with Your Consent

We may share your personal data with other third parties where you have given us explicit consent to do so, for example, to receive communications from our carefully selected marketing partners.

7.7 International Data Transfers

Some of our service providers and technology platforms may be located outside of Australia and outside the European Economic Area. Where we transfer personal data internationally, we ensure appropriate safeguards are in place, which may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission (for transfers from the EEA)
• The recipient country being recognised as providing an adequate level of data protection
• Binding Corporate Rules (BCRs) adopted by the recipient organisation
• Your explicit consent (where no other safeguard applies)
• Compliance with the Australian Privacy Act's requirements for cross-border disclosure

You may request details about the specific safeguards applied to any international transfer of your personal data by contacting us at privacy@valvellianprestigehaven.com.

8. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. The specific retention periods we apply are as follows:

Upon expiry of the relevant retention period, your personal data will be securely deleted, anonymised, or pseudonymised in accordance with our internal data destruction procedures. Where data is anonymised, it may be retained indefinitely for statistical and analytical purposes, as it will no longer constitute personal data.

9. Cookies and Similar Technologies

Our Website uses cookies, web beacons, pixel tags, and similar tracking technologies to enhance your browsing experience, analyse Website performance, and deliver relevant advertising and content. Cookies are small text files stored on your device when you visit our Website.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Website to function correctly. These cannot be disabled without affecting core Website functionality. No consent is required for these cookies.
• Performance and Analytics Cookies: Collect anonymous information about how visitors use our Website, such as pages visited and error messages encountered. We use this data to improve our Website. These cookies require your consent.
• Functionality Cookies: Remember your preferences and settings (such as language and region) to provide a more personalised experience. These cookies require your consent.
• Targeting and Advertising Cookies: Used to deliver advertisements relevant to your interests and to measure the effectiveness of advertising campaigns. These cookies are set by us or our advertising partners and require your explicit consent.

You can manage your cookie preferences at any time by accessing our cookie consent banner on the Website or by adjusting your browser settings to refuse or delete cookies. Please note that refusing certain cookies may impair the functionality of our Website. For full details on the cookies we use, please refer to our separate Cookie Policy, available on our Website.

10. Your Rights as a Data Subject

Subject to applicable law and certain conditions, you have the following rights in respect of your personal data. These rights apply to individuals located in the EEA and United Kingdom under the GDPR, and similar rights are available to Australian residents under the Privacy Act 1988 (Cth). We will respond to all valid requests within 30 days, which may be extended by a further two months in complex cases (we will notify you of any extension).

10.1 Right of Access (Article 15 GDPR)

You have the right to request confirmation of whether we process personal data about you and, if so, to obtain a copy of that personal data along with information about how it is processed. This is commonly referred to as a Subject Access Request (SAR).

10.2 Right to Rectification (Article 16 GDPR)

You have the right to request that we correct any inaccurate personal data we hold about you without undue delay. You also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

10.3 Right to Erasure ("Right to be Forgotten") (Article 17 GDPR)

In certain circumstances, you have the right to request that we delete your personal data. This right applies where the personal data is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis exists), or where you object to processing and there are no overriding legitimate grounds. This right is not absolute and may not apply where retention is required by law.

10.4 Right to Restriction of Processing (Article 18 GDPR)

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data, when processing is unlawful but you do not want erasure, or when you have objected to processing pending verification of our legitimate grounds.

10.5 Right to Data Portability (Article 20 GDPR)

Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format. You also have the right to request that we transmit that data directly to another data controller where technically feasible.

10.6 Right to Object (Article 21 GDPR)

You have the right to object at any time to the processing of your personal data where we rely on legitimate interests (Article 6(1)(f) GDPR) as the legal basis, including profiling for direct marketing purposes. Where you object to direct marketing, we will cease processing your data for that purpose immediately. Where you object to other legitimate interests processing, we will cease unless we can demonstrate compelling legitimate grounds that override your interests.

10.7 Rights Related to Automated Decision-Making and Profiling (Article 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you. Where we engage in such processing, we will inform you and provide you with the opportunity to request human review of the decision, to express your point of view, and to contest the decision.

10.8 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent, please contact us or use the unsubscribe link in our marketing emails.

10.9 Right to Lodge a Complaint with a Supervisory Authority

If you believe that we have processed your personal data in violation of applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority:

• For EEA residents: The supervisory authority in the EU member state of your habitual residence, place of work, or the place of the alleged infringement. A list of EEA supervisory authorities is available at: https://edpb.europa.eu
• For UK residents: The Information Commissioner's Office (ICO) — ico.org.uk
• For Australian residents: The Office of the Australian Information Commissioner (OAIC) — oaic.gov.au

We encourage you to contact us first before lodging a formal complaint so that we have the opportunity to resolve your concern directly.

10.10 How to Exercise Your Rights

To exercise any of the rights listed above, please submit a written request to:

• Email: privacy@valvellianprestigehaven.com
• Postal Address: The Data Protection Officer, ,

To protect your privacy and ensure we action requests on behalf of the correct individual, we may ask you to provide proof of identity before processing your request. We will not charge a fee for handling your request unless it is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or refuse to act on the request.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, disclosure, or misuse. Our security measures include, but are not limited to:

• Encryption of personal data in transit using Transport Layer Security (TLS)
• Encryption of sensitive data at rest within our databases and storage systems
• Access controls and role-based permissions limiting access to personal data to authorised personnel only
• Regular security assessments, vulnerability scanning, and penetration testing
• Staff training on data protection obligations and information security best practices
• Incident response procedures for detecting and responding to personal data breaches
• Physical security measures at our premises, including CCTV, access control systems, and security personnel
• PCI-DSS compliant payment processing infrastructure

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with Article 33 of the GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

While we take every reasonable precaution to protect your data, no transmission over the internet or electronic storage method is entirely secure. We therefore cannot guarantee absolute security.

12. Children's Privacy

Our casino services are strictly restricted to individuals who are 18 years of age or older (or such higher age as required by applicable gambling legislation). We do not knowingly collect personal data from children under the age of 18 in connection with casino activities.

In relation to our hotel accommodation services, we may collect limited personal data about minor guests accompanying adult guests (for example, names for reservation purposes). Such data is collected only with the consent of a parent or legal guardian and is used solely for the purpose of managing the accommodation booking.

Our Website and direct marketing communications are not directed at children under the age of 16. If you believe that we have inadvertently collected personal data from a child without appropriate consent, please contact us at privacy@valvellianprestigehaven.com so that we may take prompt action to delete such data.

13. Profiling and Automated Decision-Making

We may use automated tools and algorithms to analyse your personal data and create profiles to better understand your preferences and tailor our offers and services to you. For example, we may use your stay history, spending patterns, and gaming activity to recommend relevant promotions or personalise your experience.

Where we make decisions that produce legal or similarly significant effects on you using solely automated means, we will inform you of this, explain the logic involved, and provide you with the opportunity to request human review and to contest the decision. You may exercise your rights under Article 22 GDPR by contacting us at privacy@valvellianprestigehaven.com.

14. Third-Party Websites and Links

Our Website may contain links to third-party websites, social media platforms, and online services. When you follow a link to an external website, that website operates independently of us and is governed by its own privacy policy. We are not responsible for the privacy practices of third-party websites and encourage you to review their privacy policies before providing any personal data to them.

15. Changes to This Privacy Policy

We reserve the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or our services. When we make material changes, we will notify you by posting the updated Privacy Policy on our Website with a revised "Last Updated" date at the top of the document. Where required by law, we will provide more prominent notice or seek your renewed consent.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of our Website or services following the posting of changes constitutes your acknowledgement of the updated Privacy Policy.

16. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please do not hesitate to contact us:

We are committed to working with you to fairly and promptly resolve any concerns you may have about our processing of your personal data. If you remain unsatisfied with our response, you have the right to escalate your complaint to the relevant supervisory authority as set out in Section 10.9 of this Privacy Policy.